max / makenotwork

Fix the two upload defects the shape recon deferred Both found while drawing Shape 3's line and both left out of it, on the grounds that a conversion is the wrong place to change behaviour. formatEta rounded twice. `ceil(sec / 60)` for the minutes and `ceil(sec % 60)` for the remainder, so 125 seconds printed "3m 5s": the minutes had already absorbed the five and it was added again. Rounding to whole seconds once and splitting after gives "2m 5s", and it also keeps the remainder under a minute, which floor-then-ceil would not have (119.5 seconds would have read "1m 60s"). The test asserted the wrong answer with a comment checking the arithmetic of the expression rather than the meaning of the result, so it changes with the code, and a second test covers the two boundaries the old spelling got wrong. Fixed in both copies. static/upload.js is the original and s3.logic.ts is its typed port, which is how the bug survived the port. item-upload.js wrote a file name into a title attribute through a hand-rolled escape that covered only the double quote, eleven lines above a helper covering four characters and two lines below a call to the global covering five. All three were escaping the same untrusted string. The local helper is gone and both sites take escapeHtml, which the file was already calling.